Document Management Guidance

Table of Contents

1. INTRODUCTION ................................................................................................................. 2

2. DIFFERENCE BETWEEN DOCUMENTS AND RECORDS ............................................... 2

3. REQUIREMENTS FOR CONTROLLING DOCUMENTS AND RECORDS ........................ 3

3.1 DOCUMENT CONTROL ................................................................................................... 3

3.2 CONTROL OF RECORDS ................................................................................................ 3

4. WHAT’S SO IMPORTANT ABOUT RECORDS? ................................................................ 3

5. 21 RECORDS REQUIRED BY ISO 9001:2008................................................................... 4

6. THE DOCUMENT CONTROL FUNCTION.......................................................................... 6

7. SUMMARY........................................................................................................................... 6

www.iso-9001-checklist.co.uk Page 1 of 6
 Document Management Guidance

1. Introduction
The document control procedure, the control of records procedure and their associated
forms which are included in this package are to be used as templates in developing
your own document management system. Review the text in the procedures and forms;
replace the text to match your requirements. At a minimum, the blue text should be
replaced with your information. [Your Company] indicates that you should use your
Company’s name in that location. The package comprises the following documents:

Title Ref. No. of Pages

4.2.3 Control of Documents Procedure QP1 6
Master Document Index F101.1 1
Document Issue Sheet F101.2 1
Document Change Request F101.3 2
4.2.4 Control of Records Procedure QP2 5
Master Quality Record Index F102.1 1

The document control procedure (4.2.3) and control of records procedure (4.2.4) are
usually the first of the six mandatory procedures to be initiated when implementing an
ISO 9001:2008 quality management system.

A robust document management process invariably lies at the heart of any compliant
quality management system; since almost every aspect of auditing and compliance
verification is determined through the scrutiny of documented evidence. With this in
mind, it becomes apparent that the ongoing maintenance of an efficient document
management system must not be overlooked.

2. Difference between Documents and Records

What does ISO 9000:2005 tell us about the difference between documents and records
and furthermore; why it should matter?

The standard tells us that documents are considered as information (e.g. specifications
or procedures) and its supporting medium (e.g. paper or electronic). The standard
implies that over time these documents will evolve as new information supersedes old
and that change must be managed. Documents are active and dynamic.

Records, on the other hand, are more static since they are historical in nature. They are
the documents that state the results of activities undertaken in accordance with the
product realization, measurement, analysis and improvement processes (e.g.

www.iso-9001-checklist.co.uk Page 2 of 6
 Document Management Guidance

calibration logs and non-conformance or corrective action reports). They also provide
evidence that an activity was performed in the manner specified (e.g. inspection and
test records).

3. Requirements for Controlling Documents and Records

What does ISO 9001:2008 tell us about ensuring compliance with the principal
requirements of document control procedures?

3.1 Document Control

Clause 4.2.3 tells us that an organization must control the documentation required by
the quality management system and that a suitable document control procedure must
be implemented to define the controls needed to; approve, review, update, identify
changes, identify revision status and provide access. The document control procedure
must clearly define the scope, purpose, method and responsibilities required to
implement these parameters.

ISO 9001:2008 does not define how an organization should format its documentation,
since most organizations maintain a consistent corporate image, it is expected that any
corporate format will suffice.

3.2 Control of Records

Similarly; Clause 4.2.4 demands that an organisation must implement a documented

procedure to define the controls needed for the identification, storage, protection,
retrieval, retention and disposal of records and that these records must remain legible
and identifiable throughout their retention period.

It is acceptable to combine the control of records procedure with the document control
procedure but care should be taken not to obscure the fundamental intent behind
record keeping and document management.

4. What’s so important about Records?

Records are an important organizational asset; they provide the primary route for
evidence based verification and traceability since they demonstrate compliance with
customer requirements. Records also prove the efficacy of the quality management
system.

www.iso-9001-checklist.co.uk Page 3 of 6
 Document Management Guidance

Delivery of such records to a client is often a contractual and legal requirement. In

certain industries, such as civil engineering, assurance records become a fundamental
point of reference when determining compliance with the intended design as well as
helping to satisfy the requirements prescribed by building control authorities and the
health and safety executive. These records are demonstrative of a contractor’s duty of
care and that the end product is fit for purpose.

5. 21 Records Required by ISO 9001:2008

Implementing a compliant document management system could mean keeping certain

records that your organization might not be already keeping. Some of these records
may seem a little confusing until you become more familiar with the quality standard.

Of course, you might decide to keep more records than those listed below, if you feel
your organization needs them, but as we always preach; keep your system simple. The
fewer documents and records you keep, the fewer things that will be audited, and the
more time you will have to actually run your business.

Records required by ISO 9001:2008:

Clause Process
Record Description Example Record
Ref. Owner

Management review Project

5.6.1 Management reviews
minutes Manager

Training plan, training

Education, training, skills and Human
6.2.2 (e) matrix, training records
experience Resources
and CVs

Evidence that the realisation processes Quality

7.1 (d) Project quality plan
and resulting product fulfil requirements Manager

Results of the review of requirements

Design
7.2.2 related to the product and actions Change review
Manager
arising from the review

Customer
Design and development inputs relating Design
7.3.2 specifications, design
to product requirements Manager
approval logs

Results of design and development Design development Design

7.3.4
reviews and any necessary actions minutes Manager

Results of design and development Design plan, test plan Quality

7.3.5
verification and any necessary actions document outputs Manager

www.iso-9001-checklist.co.uk Page 4 of 6
 Document Management Guidance

Clause Process
Record Description Example Record
Ref. Owner

Results of design and development Test plans, test reports Quality

7.3.6
validation and any necessary actions and acceptance records Manager

Results of the review of design and

Design
7.3.7 development changes and any Design review minutes
Manager
necessary actions

Supplier and /or

Results of supplier evaluations and any subcontractor
Procurement
7.4.1 necessary actions arising from the evaluations and/or
Manager
evaluations assessments, approved
supplier list
As required by the organization to
demonstrate the validation of processes
Schedules of achieved Quality
7.5.2 (d) where the resulting output cannot be
results Manager
verified by subsequent monitoring or
measurement

The unique identification of the product, Quality

7.5.3 Serial number logs
where traceability is a requirement Manager

Customer property that is lost, damaged Delivery notes,

Plant
7.5.4 or otherwise found to be unsuitable for defective material
Manager
use reports or NCRs
Basis used for calibration or verification
Customer
of measuring equipment where no Quality
7.6 (a) specifications/corporate
international or national measurement Manager
standards
standards exist
Validity of the previous measuring
Test plan document Quality
7.6 results when the measuring equipment
outputs Manager
is found not to conform to requirements

Calibration
Results of calibration and verification of Quality
7.6 certificates/records and
measuring equipment Manager
calibration logs

Internal audit results and follow-up Quality

8.2.2 Internal audit report
action Manager

Indication of the person(s) authorising Release acceptance Quality

8.2.4
release of product. record Manager

Nature of the product nonconformities Non conformance

Quality
8.3 and any subsequent actions taken, report, concession
Manager
including concessions obtained report

Corrective action Quality

8.5.2 Results of corrective action
reports and logs Manager

Preventive action Quality

8.5.3 Results of preventive action
reports and logs Manager

www.iso-9001-checklist.co.uk Page 5 of 6
 Document Management Guidance

Also keep in mind that you are free to combine some of these records where it makes
sense, for example, you could combine the corrective action request and preventive
action request records with a simple checkbox to note which one it is. You could also
combine both corrective action and preventive action requests onto one form, again
with a check box to designate if it is a corrective or preventive action request.

Please note this is a list of the records you will be required to keep. This does not deal
with the mandatory documents, comprising of the quality manual, policy and
procedures, &c.

6. The Document Control Function

The document control function is an administrative management activity and operates
on the frontline by ensuring compliance with Clause 4.2, amongst others, and the
associated control of documents and records procedures. Generally, the document
control function should have a direct report to the Quality Representative.

7. Summary
Remember; keep it simple and allow the process owners to write or revise the
documents they need. Use the document management function to apply formatting and
revision changes as well as looking after distribution and retention. It is best to interpret
the requirements as they apply to your company; there is no hard and fast method.

www.iso-9001-checklist.co.uk Page 6 of 6